Supabase confirmation or reset email opens localhost:3000? Here's the fix

When a user signs up for a Supabase live application, clicks the confirmation link, or requests a password reset, they are directed to the localhost:3000 URL. This occurs because Supabase builds email links from the project's Site URL, which defaults to localhost:3000 for new projects. This issue affects apps built with various frameworks like Lovable, Bolt, and Replit on Supabase, particularly after the first real users arrive.

The Site URL is set to localhost:3000 by default. Every confirmation and reset link falls back to this URL, causing them to all point to localhost:3000. The redirect address isn't allowed in Supabase. If your app redirects to a location not on the Redirect URLs list, Supabase uses the Site URL instead. A customised email template uses {{ .SiteURL }}, which ignores the redirect passed by the app.

To resolve this issue, you can either set the Site URL to your live domain, add every redirect address under Redirect URLs, and pass a redirect address that is on that list, or pass the redirect address from the app using window.location.origin.

After making these changes, check by signing up with a new email address. The confirmation link should open your live site and sign the user in. Similarly, requesting a password reset should open the reset page on the live domain. This fix does not require redeployment, as it's a project setting that new emails use immediately. However, emails already sent keep their old links, so affected users should request a new confirmation or reset email.